4.1.3. Gateway Load Balancer
Gateway Load Balancer enables transparent insertion of NVAs (firewalls, IDS) into existing traffic flows.
Architecture:
Key Characteristics:
- Bumps-in-the-wire deployment (transparent)
- NVAs see original source/destination
- No route changes needed
- Supports any Standard Load Balancer
How it stays transparent. The Gateway Load Balancer is chained to an existing frontend — you point a Standard public load balancer or a public IP at it, and traffic is diverted through the appliance and back on its way to the original destination. The original packet is carried inside a VXLAN tunnel to the NVA, so the appliance sees the true source and destination addresses rather than something rewritten by a proxy.
Compare it with the alternative. The traditional way to insert a firewall is a user-defined route sending traffic to the appliance's IP. That works, but it changes the routing of every subnet involved, it must be maintained as subnets are added, and the appliance becomes a named hop in your topology. Chaining a Gateway Load Balancer changes no routes at all and scales the appliance tier behind its own health probes.
💡 First Principle: If a question asks for third-party inspection without altering the application architecture or its routing, that phrasing is pointing at Gateway Load Balancer rather than at UDRs.
